View on GitHub

3.5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa

• Tweet

• DNSSEC
• Responses
• Servers
• Analyze

DNSSEC options (hide)

1. |?| RR types: --All-- A AAAA TXT PTR MX NS SOA CNAME SRV NAPTR TLSA NSEC3PARAM CDNSKEY CDS CAA
2. |?| DNSSEC algorithms: --All-- 1 - RSA/MD5 3 - DSA/SHA1 5 - RSA/SHA-1 6 - DSA-NSEC3-SHA1 7 - RSASHA1-NSEC3-SHA1 8 - RSA/SHA-256 10 - RSA/SHA-512 12 - GOST R 34.10-2001 13 - ECDSA Curve P-256 with SHA-256 14 - ECDSA Curve P-384 with SHA-384 15 - Ed25519 16 - Ed448
3. |?| DS digest algorithms: --All-- 1 - SHA-1 2 - SHA-256 3 - GOST R 34.11-94 4 - SHA-384
4. |?| Denial of existence:
5. |?| Redundant edges:
6. |?| Ignore RFC 8624:
7. |?| Ignore RFC 9276:
8. |?| Multi-signer:
9. |?| Trust anchors:
   • Root zone KSK
10. |?| Additional trusted keys:

Notices

DNSSEC Authentication Chain

RRset status

Bogus (1)

• 3.5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/PTR

DNSKEY/DS/NSEC status

Bogus (6)

• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 25124)
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 57718)
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718)
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718)
• 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 12255)
• 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 47242)

Secure (19)

• ./DNSKEY (alg 8, id 20326)
• ./DNSKEY (alg 8, id 42351)
• 5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 41755)
• 5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 53670)
• 5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 63271)
• 5.0.1.0.0.2.ip6.arpa/DNSKEY (alg 5, id 65071)
• 5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 53670)
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242)
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242)
• arpa/DNSKEY (alg 8, id 41685)
• arpa/DNSKEY (alg 8, id 42581)
• arpa/DS (alg 8, id 42581)
• arpa/DS (alg 8, id 42581)
• ip6.arpa/DNSKEY (alg 8, id 21619)
• ip6.arpa/DNSKEY (alg 8, id 50130)
• ip6.arpa/DNSKEY (alg 8, id 64060)
• ip6.arpa/DS (alg 8, id 13880)
• ip6.arpa/DS (alg 8, id 45094)
• ip6.arpa/DS (alg 8, id 64060)

Non_existent (2)

• ip6.arpa/DNSKEY (alg 8, id 13880)
• ip6.arpa/DNSKEY (alg 8, id 45094)

Delegation status

Bogus (1)

• 5.0.1.0.0.2.ip6.arpa to 9.5.5.0.1.0.0.2.ip6.arpa

Secure (4)

• . to arpa
• 9.5.5.0.1.0.0.2.ip6.arpa to 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa
• arpa to ip6.arpa
• ip6.arpa to 5.0.1.0.0.2.ip6.arpa

Notices

Errors (3)

• 5.0.1.0.0.2.ip6.arpa to 9.5.5.0.1.0.0.2.ip6.arpa: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (68.87.68.244, 68.87.72.244, 68.87.76.228, 68.87.85.132, 69.252.250.103, 2001:558:1004:7:68:87:85:132, 2001:558:100a:5:68:87:68:244, 2001:558:100e:5:68:87:72:244, 2001:558:1014:c:68:87:76:228, 2001:558:fe23:8:69:252:250:103, UDP_-_EDNS0_4096_D_KN)
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 47242: The Signature Expiration field of the RRSIG RR (2021-02-03 13:23:52+00:00) is 4 days in the past. See RFC 4035, Sec. 5.3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 47242: The Signature Expiration field of the RRSIG RR (2021-02-03 13:23:52+00:00) is 4 days in the past. See RFC 4035, Sec. 5.3.1.

Warnings (38)

• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 57718): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• 5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 53670): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 53670): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): In the spirit of RFC 4509, DS records with digest type 1 (SHA-1) might be ignored when DS records with digest type 4 (SHA-384) exist in the same RRset. See RFC 4509, Sec. 3.
• 9.5.5.0.1.0.0.2.ip6.arpa/DS (alg 5, id 47242): In the spirit of RFC 4509, DS records with digest type 1 (SHA-1) might be ignored when DS records with digest type 4 (SHA-384) exist in the same RRset. See RFC 4509, Sec. 3.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 25124: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 25124: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 57718: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 57718: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS alg 5, id 12255: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/DS alg 5, id 12255: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 3.5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/PTR alg 5, id 25124: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 53670: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 53670: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 53670: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 53670: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 12255: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 12255: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 47242: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DNSKEY alg 5, id 47242: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DS alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• RRSIG 9.5.5.0.1.0.0.2.ip6.arpa/DS alg 5, id 65071: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 5 (RSASHA1). See RFC 8624, Sec. 3.1.
• arpa/DS (alg 8, id 42581): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• arpa/DS (alg 8, id 42581): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
• arpa/DS (alg 8, id 42581): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• arpa/DS (alg 8, id 42581): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
• 0.0.0.8.9.5.5.0.1.0.0.2.ip6.arpa/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.

DNSKEY legend

Full legend

	SEP bit set
	Revoke bit set
	Trust anchor

See also

DNSSEC Debugger by Verisign Labs.

Download: png | svg

JavaScript is required to make the graph below interactive.

Questions and Comments

Copyright © 2010 - 2014 Sandia Corporation